2. Preparation phase
This is phase two of the five-phase PIA process.
The purpose of this phase is to make the arrangements needed to enable the critical phase three to run smoothly.
The suggested deliverables are a stakeholder analysis, a consultation strategy and plan, and the establishment of a PIA consultative group (PCG). The following tasks are suggested:
- Develop a consultation plan to ensure that discussions with stakeholders are effective.
- Form a PIA consultative group (PCG). This comprises representatives of stakeholder groups.
- Distribute the project background paper to the PCG. This ensures that the PCG members can understand the nature of the proposal.
Developing a consultation plan
Any project that is sufficiently complex and potentially privacy-threatening that it requires a full-scale PIA is likely to affect many parties. To ensure you make the most of the consultation and analysis phase, it is useful to put a consultation plan in place.
Remember that any consultation should be appropriate to the scale, scope and nature of the project for which a PIA is being completed. Large-scale projects that embody significant privacy risks, might use most or all of the methods described below. In small-scale projects it may not be necessary to use all of these. Some organisations might already have a well-developed consultation strategy in place and there is no reason why any PIA consultation cannot be completed within this strategy. For those organisations who do not have a consultation strategy in place, further advice is provided below.
Effective consultation depends on all stakeholders being sufficiently well-informed about the project, having the opportunity to convey their perspectives and their concerns, and developing confidence that their perspectives are being reflected in the design.
It is common for consultation processes to result in changes to the project and to its design. In order to make the maximum contribution to risk management in return for the smallest cost, consultation therefore needs to commence early and continue throughout the project life-cycle. Some useful ways of ensuring effective consultation include:
- priming of discussions by providing some initial information about the project;
- making sure there is ongoing dialogue with consultees throughout the PIA process;
- participation of representatives of, and advocates for, stakeholder groups who have appropriate background in the technologies, systems and privacy impacts involved;
- facilitated interactions among the participants;
- making sure that there is sufficient diversity among those groups or individuals being consulted, to ensure that all relevant perspectives are represented, and all relevant information is gathered;
- making sure that each group has the opportunity to provide information and comment, even including multiple rounds of consultation where necessary;
- making sure that the method of consultation suits the consultation group, for example using workshops or focus groups as an alternative to, or even as well as, formal written consultation;
- making sure that the information provided by all parties to the consultation is fed into the subsequent rounds of design and implementation activities; and
- ensuring that the perspectives, concerns and issues raised during the consultation process are seen to be reflected in the outcomes of the PIA process.
Devise communication processes that will enable the effective interchange of ideas. This may involve workshops and meetings, perhaps supplemented by formal submissions.
Where security considerations or indeed other privacy concerns prevent the consultation processes from being fully open, it is suggested that:
- the PIA be undertaken in as open a manner as is possible;
- parts which have security concerns be separated into closed or confidential appendices and separate, relatively closed discussion sessions; and
- where security considerations result in the suppression of information, proxy measures be devised that are as effective and credible as possible. (For example, the security-sensitive information could be provided to a trusted third party who could then deliver to PCG members evaluative comments that avoid exposing the information).